MAX and Gosuslugi (Госуслуги): why linking a messenger, passport and digital ID is dangerous
The link between the MAX messenger and the Gosuslugi digital ID makes it possible to receive government services directly in a chat window — without switching to a browser or a separate app. In terms of convenience, this is a step toward a “super app” modeled on China’s WeChat. In terms of digital security, it is data concentration: one service that at the same time has a phone number, contacts, communication metadata, a link to a passport, SNILS, INN, and the history of government services.
The integration itself is legal, and Gosuslugi says this openly: a digital ID is an electronic personal identifier that can be used in different services, including MAX (see the Gosuslugi FAQ about digital ID). The question is not legality, but what risks arise if one link in the chain is compromised and whether those risks can be reduced using built-in tools.
Below is a neutral breakdown of how the integration works, what “MAX knows my passport” means, and what minimum precautions make sense if you do use the link.
In short
- The Gosuslugi digital ID in MAX gives access to government services directly in the messenger.
- One linked setup can include: phone number, contacts, messages, passport, SNILS, INN, and government services history.
- A takeover of a MAX or Gosuslugi account gives access to an expanded digital profile — much larger than the usual compromise of a single account.
- The link does not have to be activated: MAX and Gosuslugi work independently.
- If the link is needed, two-factor authentication through the Gosuslugi app and device control are mandatory.
How the integration works
From the user’s side, it looks like “logging in to Gosuslugi with one tap” inside the messenger. Technically, it is a link between two accounts through ESIA.
Digital ID as a bridge
A digital ID is a set of verified information about the user from the Gosuslugi account: name, date of birth, passport details, and SNILS. When logging in to MAX through a digital ID, the messenger receives not the passport itself, but confirmation that “the identity has been verified,” and can then request specific data for a specific service.
What the messenger “knows” by default
Without activating the link, it has the standard set: phone number, profile name, contacts if permission is granted, and message metadata. With the link activated, the categories of government services the user accessed through the messenger and a verified personal identifier are added.
What the messenger does not receive directly
A full electronic medical record, the full tax history, or correspondence with other agencies outside MAX. This data remains on the side of Gosuslugi and the relevant agencies; the messenger sees only what the user explicitly requests through it.
Jurisdiction and storage
Data processing is governed by the Russian law on personal data (Federal Law 152-FZ) and on communications (see the overview of changes on consultant.ru). Servers are located in the Russian Federation. Requests from government bodies follow the established procedure.
What compromise of the link means
| Scenario | What the attacker gets | What to do |
|---|---|---|
| MAX account stolen (without a link to Gosuslugi) | Messages, contacts, access to private chats | Change the password, log out of all devices, warn contacts |
| MAX account stolen (with the link) | Additionally, the history of government service requests and a verified ID | Immediately unlink MAX from Gosuslugi and check the Gosuslugi log |
| Gosuslugi account stolen | Access to the entire digital profile | Block it through the hotline, recover access through an MFC |
| SIM swap | Interception of SMS codes from Gosuslugi and MAX | Switch to 2FA through the app, check SIM status |
| Phishing link “from Gosuslugi” in MAX | Gosuslugi login and password | Never enter your password through a link from a messenger |
How to check right now
In your Gosuslugi personal account, open the “Security” section and check whether MAX is listed among the permitted external services. If it is and you do not need it, unlink it. In MAX itself, open “Settings → Security” and check active sessions: one extra login is a reason to change the password and update the second factor.
If the link is needed, the minimum is two-factor authentication through the “Gosuslugi” app (not SMS) and regular review of the activity history. It also makes sense to check whether your full name appears in the public wanted database of the Ministry of Internal Affairs — this is a separate risk that is also tied to government databases but exists independently of the messenger.
Check your full name in the Ministry of Internal Affairs wanted register
Warning signs vs false alarm
A warning sign is the appearance in Gosuslugi of a new permitted app that you did not connect; a notification about login through a digital ID in MAX from an unfamiliar device; requests from “support” to confirm a password through the messenger. All of these are signs of an attempt to use the link against you.
A false alarm is the mere fact that a “Gosuslugi” menu appeared in MAX. This is just an interface. Without your consent, the link between accounts is not activated; the menu without a connected digital ID has no access to your data.
What to do next
- If the link is not needed, do not activate it; MAX and Gosuslugi work fully as separate services.
- If the link is needed, enable 2FA through the Gosuslugi app, not through SMS.
- Regularly check the “Security” section in both services: device list, permitted apps, logins.
- Do not enter your Gosuslugi password through links from MAX, email, or SMS — only in a browser on gosuslugi.ru or in the official app.
- If you need to receive a government service through the messenger, revoke access after receiving it if it is no longer needed.
- Make a habit of checking “Activity history” in Gosuslugi once a month: extra requests are a reason to change the password.
- If you suspect an account takeover, block the account immediately through the hotline; do not try to “sort it out yourself.”
Disclaimer: this material is informational and is not legal advice. For a specific situation, contact a lawyer. The composition of the MAX integration with Gosuslugi and the set of services available through the messenger change regularly; check the current terms and consents in the account itself.
Conclusion
The integration of MAX with the Gosuslugi digital ID is convenience at the price of data concentration. The same login starts opening both messages and the government profile. The link is not mandatory: if it is not activated, the messenger and the portal continue to work as two independent services. If the link is used, basic measures — the app as a second factor, device control, and caution with phishing — noticeably reduce typical compromise scenarios.